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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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1 Scope 

The present document defines the user plane of GTP used on: 

• the Gn and Gp interfaces of the General Packet Radio Service (GPRS); 

• the lu, Gn and Gp interfaces of the UMTS system; 

• the Sl-U, S2b-U, X2, S4, S5, S8 and S12 interfaces of the Evolved Packet System (EPS); 

This definition ensures full backwards compatibility with RNC, SGSN and GGSN implementations according to release 
7of3GPPTS29.060[6]. 

NOTE: Releases previous to Release-8 have used 3GPP TS 29.060 [6] as normative definition of the user plane 
of GTP. This shall be considered when essential corrections are included in the present document or in 
pre-release-8 version of 3GPP TS 29.060 [6]. 

Fallback from GTPvl-U to GTPvO-U shall not be supported. Therefore, 3GPP Rel-8 and onwards GTPvl-U entity 
should not listen to the well-known GTPvO port 3386. If GTPvl entity listens to the GTPvO port, the entity shall silently 
discard any received GTPvO-U message. 

2 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[I] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications". 

[2] 3GPP TS 23.003: "Numbering, addressing and identification". 

[3] 3GPP TS 23.007: "Restoration procedures". 

[4] 3GPP TS 23.060: "General Packet Radio Service (GPRS); Service description; Stage 2". 

[5] 3GPP TS 23.401 : "General Packet Radio Service (GPRS) enhancements for Evolved Universal 

Terrestrial Radio Access Network (E-UTRAN) access". 

[6] 3GPP TS 29.060: "General Packet Radio Service (GPRS); GPRS Tunnelling Protocol (GTP) 

across the Gn and Gp interface". 

[7] 3GPP TS 29.274: "3GPP Evolved Packet System; Evolved GPRS Tunnelling Protocol for EPS 

(GTPv2)". 

[8] 3GPP TS 32.295: "Telecommunication management; Charging management; Charging Data 

Record (CDR) transfer". 

[9] IETF RFC 768 (STD 0006): "User Datagram Protocol", J. Postel. 

[10] IETF RFC 791 (STD 0005): "Internet Protocol", J. Postel. 

[II] IETF RFC 2373: "IP Version 6 Addressing Architecture". 

[12] 3GPP TS 33.210: "3G security; Network Domain Security (NDS); IP network layer security". 
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[13] 3GPP TS 23 . 1 2 1 : "Architectural requirements for Release 1 999" . 

[14] 3GPP TS 43.129: "Packet-switched handover for GERAN A/Gb mode; Stage 2". 

[15] IETF RFC 2460: "Internet Protocol, Version 6 (IPv6) Specification", Standards Track 

[ 1 6] 3GPP TS 25 .4 1 3 : "UTRAN lu interface RAN AP signalling" . 

[17] 3GPP TS 36.300: "Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal 

Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2". 

[18] 3GPP TS 23.246: "Multimedia Broadcast/Multicast Service (MBMS); Architecture and functional 

description; Stage 2". 

[19] IETF RFC 4604 (2006): "Using Internet Group Management Protocol Version 3 (IGMPv3) and 

Multicast Listener Discovery Protocol Version 2 (MLDv2) for Source-Specific Multicast". 

[20] IETF RFC 4607 (2006): "Source-Specific Multicast for IP". 

[21] 3GPP TS 33.102: "3G Security;Security architecture". 

[22] 3GPP TS 33.401: "3GPP System Architecture Evolution (SAE): Security architecture ". 



3 Definitions and abbreviations 

3.1 Definitions 

For the purposes of the present document, the terms and definitions given in TR 21.905 [1] and the following apply. A 
term defined in the present document takes precedence over the definition of the same term, if any, in TR 2 1 .905 [ 1 ] . 

GTP-U peer: node implementing at least one side of any of the GTP user plane based protocols. RNC, SGSN, GGSN, 
eNodeB, SGW, ePDG or PGW. 

3.2 Abbreviations 

For the purposes of the present document, the abbreviations given in TR 21.905 [1] and the following apply. An 
abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in 
TR 21.905 [1]. 

GTP-U Message: GTP-U (user plane) messages are either user plane messages or signalling messages. User plane 
messages are used to carry user data packets between GTP-U entities. Signalling messages are sent between network 
nodes for path management and tunnel management. 

GTP-U Tunnel: A GTP-U tunnel is identified in each node with a TEID, an IP address and a UDP port number. A 
GTP-U tunnel is necessary to enable forwarding packets between GTP-U entities. 

UDP/IP Path: Connection-less unidirectional or bidirectional path defined by two end-points. An IP address and a 
UDP port number define an end-point. A UDP/IP path carries GTP messages between network nodes related to one or 
more GTP tunnels. 

GTP-PDU: GTP Protocol Data Unit (PDU) is a GTP-U message, which may be either a G-PDU or a signalling 

message. 

G-PDU: User data packet (T-PDU) plus GTP-U header, sent between GTP network nodes. 

Signalling Message: A GTP-U message (GTP-PDU that is not a G-PDU) sent between GTP network nodes. These may 
be Path Management messages or Tunnel Management messages. 

T-PDU: A user data packet, for example an IP datagram, sent between a UE and a network entity in an external packet 
data network. A T-PDU is the payload that is tunnelled in the GTP-U tunnel. 
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Tunnel Endpoint Identifier (TEID): Unambiguously identifies a tunnel endpoint in the receiving GTP-U protocol 
entity for a given UDP/IP endpoint. The receiving end side of a GTP tunnel locally assigns the TEID value the 
transmitting side has to use. The TEID values are exchanged between tunnel endpoints using control plane messaging. 

ePDG Evolved Packet Data Gateway 

GSN GPRS Support Node 

GGSN Gateway GPRS Support Node 

G-PDU GTP encapsulated user Plane Data Unit 

GTP GPRS Tunnelling Protocol 

GTP-C GTP Control 

GTP-U GTP User 

IE Information Element 

IGMP Internet Group Management Protocol 

IP Internet Protocol 

IPv4 Internet Protocol version 4 

IPv6 Internet Protocol version 6 

PDU Packet Data Unit 

PGW PDN Gateway 

QoS Quality of Service 

RANAP Radio Access Network Application Part 

RNC Radio Network Controller 

SGSN Serving GPRS Support Node 

SGW Serving Gateway 

TEID Tunnel Endpoint IDentifier 

T-PDU Transport PDU 

UDP User Datagram Protocol 

UTRAN UMTS Terrestrial Radio Access Network 

4 General 

4.1 GTP Path 

For the definition of UDP/IP Path and GTP Endpoint, see 3GPP TS 29.060 [6]. 

4.2 GTP-U Tunnels 

4.2.1 GTP-U Tunnel description 

GTP-U Tunnels are used to carry encapsulated T-PDUs and signalling messages between a given pair of GTP-U Tunnel 
Endpoints. The Tunnel Endpoint ID (TEID) which is present in the GTP header shall indicate which tunnel a particular 
T-PDU belongs to. In this manner, packets are multiplexed and de-multiplexed by GTP-U between a given pair of 
Tunnel Endpoints. The TEID value to be used in the TEID field shall be signalled to the peer GTP-U entity using a 
control plane protocol like GTPvl-C, GTPv2-C, RANAP or Sl-AP. 

In what follows we refer to the outer GTPvl-U IP packet as the IP packet that carries a GTPvl-U packet. The inner IP 
packet in a GTPvl-U packet (T-PDU) is either 

An IP packet sent to the UE/MS in the downlink direction over one or more tunnels from the external network 
identified by the APN. 

An IP packet sent from a UE/MS in the uplink direction over one or more tunnels to the external network 
identified by the APN. 

NOTE 1: Not all tunnels in 3GPP networks will necessarily be GTPvl-U, 

NOTE 2: The inner MTU size of the GTPvl-U tunnel is typically not the same as the outer MTU size of the IP path 
carrying the outer IP packets. 
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The maximum size of a T-PDU that may be transmitted without fragmentation by GGSN or the MS is defined in 
3GPPTS 23.060 [4]. 

4.2.2 IP transport 

According to IETF RFC 791 [10], any IPv4 router in the backbone may fragment the outer IPv4 GTPvl-U packet with 
afIagofDF=0. 

Unnecessary fragmentation should be avoided when possible due to the following; 

Fragmentation is bandwidth inefficient, since the complete IP header is duplicated in each fragment. 

Fragmentation is CPU intensive since more fragments require more processing at both GTPvl-U endpoints and 
IP routers. It also requires additional memory at the receiver. 

If one fragment is lost, the complete packet has to be discarded. The reason is there is no selective retransmission 
of IP fragments provided in IPv4 or IPv6. 

To avoid unnecessary fragmenting the outer IP packets backbone links between GTP peers should, when possible, have 
outer MTU values that exceed the sum of the maximum value of the inner MTU size plus the size of the tunnel headers 
(outer IP header, outer UDP header, and GTP header, including any possible GTP extension headers) in order to avoid 
unnecessary IP fragmentation in the backbone. 

To avoid unnecessary fragmenting the inner IP packets the UE/MS, or a server in an external network, may find out the 
inner MTU by path MTU discovery and hence fragment correctly at the source. 

4.2.3 GTP-U Tunnel IP transport 

Functionality for IP transport and IP fragmentation at a RAN node on the lu interface or S 12 is defined in 3GPP 
TS 25.414 [16]. 

Functionality for IP transport and IP fragmentation at an eNodeB on the Sl-U and X2 interface is defined in 3GPP 
TS 36.300 [17]. 

The outer GTPvl-U packet layer shall IPv4 as defined by IETF RFC 791 [10] and should support IPv6 as defined by 
IETF RFC 2460[15]. 

The following text as well as sub-clauses 4.2.4 and 4.2.5 apply only to core network GTPvl-U endpoints. 

GTPvl-U tunnel endpoints do not need to change the hopcount/TTL or to perform any IP routing functions in respect to 
inner IP packet other than the functions explicitly stated here. However, other co-located functions may do so. For 
example, the GGSN/PGW may change the hopcount/TTL as the IP datagram enters/leaves the Gi/SGi interface from/to 
the GTPvl-U tunnel interface and IP packets may be discarded or rejected at any point by a co-located function due to 
local policy and/or QoS (the policy enforcement point). 

4.2.4 Ingress GTP tunnel (GTPv1 -U sending endpoint) 

An inner IP packet shall be encapsulated at the GTPvl-U sender with a GTP header, UDP and IP header. If the resulting 
outer IP packet is larger than the MTU of the first link towards the destination GTPvl-U endpoint, fragmentation of the 
IP packet shall be performed by the sender as per IETF RFC 791 [10] for an outer layer of IPv4 and IETF RFC 2460 
[15] for an outer layer of IPv6. The GTPvl-U sender should preferably fragment the IP packet to the smallest MTU of 
any link between GTPvl-U sender and GTPvl-U receiver. 

Fragmentation policy of the inner datagram is implementation dependent but shall interwork with IETF RFC 791 [10] 
for inner IPv4 datagrams and IETF RFC 2460 [15] for inner IPv6 packets. 

4.2.5 Egress GTP tunnel (GTPv1 -U receiving endpoint) 

The GTPvl-U receiving endpoint packets shall reassemble any IP fragments in datagrams received from the GTPvl-U 
sending endpoint as per IETF RFC 791 [10] for outer IPv4 datagrams and as per IETF RFC 2460 [15] for outer IPv6 
datagrams. The IP reassembly buffer in the receiving endpoint shall be at least the inner MTU size plus the size of the 
tunnel headers (outer IP header, outer UDP header, and GTP header, including any GTP extension headers). 
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The completely reassembled IP packet shall then be passed to the IP/UDP/GTPvl-U layers to extract the inner IP 
packet which is then processed further according to the receiving node's functionality. 

4.2.6 MBMS IP Multicast Distribution of the User Plane Data 

GTP-U Multicast Tunnels are used for unidirectional transfer of the encapsulated T-PDUs from one GTP-U Tunnel 
Endpoint acting as an IP multicast source to multiple GTP-U Tunnel Endpoints acting as IP multicast listeners, as 
specified in TS 23.246 [18]. The Common Tunnel Endpoint ID (C-TEID) which is present in the GTP header shall 
indicate which tunnel a particular T-PDU belongs to. The C-TEID value to be used in the TEID field is allocated at the 
source Tunnel Endpoint and signalled to the destination Tunnel Endpoint using a control plane protocol i.e. GTPvl-C, 
and RANAP, GTPv2-C and Sl-AP. There is one C-TEID allocated per MBMS bearer service. 

The destination IP address in the outer GTPvl-U IP header is an address in the multicast address range as specified in 
IETF RFC 4607 [20]. 

If the RNC decides to receive IP multicast packets, then the RNC shall join the IP multicast group as specified by IETF 
RFC 4604 [19] and IETF RFC 4607 [20]. 

If the eNodeB supports MBMS as specified in TS 23.246 [18], it shall join the IP multicast group as specified in IETF 
RFC 4604 [19] and IETF RFC 4607 [20]. 

The characteristics for point-to-multipoint GTP-U Multicast Tunnels used for MBMS are the same as for a point-to- 
point GTP-U Tunnels unless specified otherwise. The differences are specified in subclause 7.1. 



4.3 GTP-U Protocol Entity 



The GTP-U protocol entity provides packet transmission and reception services to user plane entities in the RNC, 
SGSN, GGSN, eNodeB, SGW, ePDG and PGW. The GTP-U protocol entity receives traffic from a number of GTP-U 
tunnel endpoints and transmits traffic to a number of GTP-U tunnel endpoints. There is a GTP-U protocol entity per IP 
address. 

The TEID in the GTP-U header is used to de-multiplex traffic incoming from remote tunnel endpoints so that it is 
delivered to the User plane entities in a way that allows multiplexing of different users, different packet protocols and 
different QoS levels. Therefore no two remote GTP-U endpoints shall send traffic to a GTP-U protocol entity using the 
same TEID value except for data forwarding as part of mobility procedures. 

4.3.1 Handling of Sequence Numbers 

This functionality is provided only when the S bit is set to 1 in the GTP-U header. 

For PGW, SGW, ePDG and eNodeB the usage of sequence numbers in G-PDUs is optional, but if GTP-U protocol 
entities in these nodes are relaying G-PDUs to other nodes, then they shall relay the sequence numbers as well For all 
other cases, the PGW, SGW, ePDG and eNodeB should set the "S" fiag to in the GTPvl header which then indicates 
that the sequence number is not used in the T-PDU. 

An RNC, SGSN or GGSN shall reorder out of sequence T-PDUs when in sequence delivery is required. This is optional 
at the SGSN for UTRAN access. The GTP-U protocol entity shall deliver to the user plane entity only in sequence 
T-PDUs and notify the sequence number associated to each of them. The notification of the sequence number is not 
necessary at the GGSN, but it is mandatory at the SGSN and RNC. The user plane entity shall provide a sequence 
number to the GTP-U layer together with T-PDUs to be transmitted in sequence. GTP-U protocol entities at the GGSN 
may optionally generate autonomously the sequence number, but should be able to use sequence numbers provided by 
the user plane entity. The sequence number is handled on a per GTP-U Tunnel (that is TEID) basis. During relocations 
and handovers, if a buffered packet is forwarded from the source to the target GTP-U protocol entity along with PDCP 
T-PDU extension headers, the source of the T-PDU may be considered different and may not relay the sequence 
numbers. 

When the sequence number is included in the GTP-U header, a user plane entity acting as a relay of T-PDUs between 
GTP-U protocol entities, or between PDCP (or SNDCP) protocol entities and GTP-U protocol entities, shall relay the 
sequence numbers between those entities as well. In this way it is possible to keep consistent values of sequence 
numbers from the GGSN to the UE (MS in GPRS) by relaying the sequence number across the CN GTP-U bearer, the 
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lu GTP-U bearer and the Radio bearer (via PDCP or SNDCP N-PDU numbers). This functionaUty is beneficial during 
SRNS relocation. 

For GTP-U signalling messages having a response message defined for a request message, Sequence Number shall be a 
message number valid for a path. Within a given set of continuous Sequence Numbers from to 65535, a given 
Sequence Number shall, if used, unambiguously define a GTP-U signalling request message sent on the path (see 
section Reliable delivery of signalling messages). The Sequence Number in a signalling response message shall be 
copied from the signalling request message that the GTP-U entity is replying to. For GTP-U messages not having a 
defined response message for a request message, i.e. for messages Supported Extension Headers Notification and Error 
Indication, the Sequence Number shall be ignored by the receiver. 



4.4 



Protocol stack 



4.4.0 GTP-PDU stacks 

The protocol stack for a GTP-PDU G-PDU is shown in Figure 4.4-1. The protocol stack for a GTP-PDU signaling 
message is shown in Figure 4.4-2. 



T-PDU (IP Datagram) 



GTPv1-U Header 



U DP/IP 



> G-PDU 



Figure: 4.4-1 G-PDU Protocol Stack 



Zero or more lEs 



GTPV1-U Header 



UDP/IP 



y Signaling IVIessage 
(Path Management or 
Tunnel Management) 



Figure: 4.4-2 Signalling Message Protocol Stack 

4.4.1 UDP/IP 

UDP/IP is the only path protocol defined to transfer GTP messages in the version 1 of GTP. 

A GTPvl-U peer shall support the User Datagram Protocol (UDP) as defined by IETF RFC 768 [9] shall be used. 

A GTPvl-U peer shall support IPv4 as defined by IETF RFC 791 [10] and should support IPv6 as defined by IETF 
RFC 2460 [15]. 
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4.4.2 UDP header and port numbers 

4.4.2.1 Echo Request Message 

The UDP Destination Port number for GTP-U request messages is 2152. It is the registered port number for GTP-U. 
The UDP Source Port is a locally allocated port number at the sending GTP-U entity. 

4.4.2.2 Echo Response Message 

The UDP Destination Port value shall be the value of the UDP Source Port of the corresponding request message. 
The UDP Source Port shall be the value from the UDP Destination Port of the corresponding request message. 

4.4.2.3 Encapsulated T-PDUs 

The UDP Destination Port number shall be 2152. It is the registered port number for GTP-U. 
The UDP Source Port is a locally allocated port number at the sending GTP-U entity. 

4.4.2.4 Error Indication 

The UDP destination port for the Error Indication shall be the user plane UDP port (2152). 

The UDP source port shall be locally assigned at the sending node. 

NOTE: In network deployments including non-GTP-aware stateful firewalls, those firewalls must be configured 
to allow response messages coming from a different UDP port and IP address than the triggering 
message. 

4.4.2.5 Supported Extension Headers Notification 

The UDP destination port for the Supported Extension Headers Notification shall be the user plane UDP port (2152). 
The UDP source port shall be locally assigned at the sending node. 

4.4.2.6 End Marker 

The UDP Destination Port number shall be 2152. It is the registered port number for GTP-U. 

The UDP Source Port is a locally allocated port number at the sending GTP-U entity. 

The UDP Destination Port and UDP Source Port shall be the same as those of the corresponding GTP-U tunnel for 
which the End Marker message is sent. 

4.4.3 IP header and IP addresses 

4.4.3.1 Echo Request Message 

The IP Source Address shall be an IP address of the source GTP-U entity from which the message is originating. 
The IP Destination Address in a GTP request message shall be an IP address of the destination GTP-U entity. 

4.4.3.2 Echo Response Message 

The IP Source Address shall be copied from the IP destination address of the GTP request message to which this 
GTP-U entity is replying. 

The IP Destination Address shall be copied from the IP Source Address of the GTP request message to which this 
GTP-U entity is replying. 
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4.4.3.3 Encapsulated T-PDUs 

The IP Source Address shall be an IP address of the source GTP-U entity from which the message is originating. 
The IP Destination Address shall be an IP address of the destination GTP-U entity. 

4.4.3.4 Error Indication 

The IP source address shall be an address of the source GTP-U entity from which the message is originated 

NOTE: In network deployments including non-GTP-aware stateful firewalls, those firewalls must be configured 
to allow response messages coming from a different UDP port and IP address than the triggering 
message. 

The IP destination address for Error Indication shall be the source address of the GTP-PDU that is the cause for this 
GTP-U entity to send this message. 

4.4.3.5 Supported Extension Headers Notification 

The IP Source Address for the Supported Extension Headers Notification shall be copied from the IP destination 
address of the GTP message that triggered the GTP-U entity to send this message. 

The IP Destination Address for the Supported Extension Headers Notification shall be copied from the IP source 
address of the GTP message that triggered the GTP-U entity to send this message. 

4.4.3.6 End Marker 

The IP Source Address shall be an IP address of the source GTP-U entity from which the message is originating. 

The IP Destination Address shall be an IP address of the destination GTP-U entity. 

The IP Destination Address and IP Source Address shall be the same as as those of the corresponding GTP-U tunnel for 
which the End Marker message is sent. 

4.5 Transmission Order and Bit Definitions 

As specified in 3GPP TS 29.060 [6], clause 5. 



4.6 New Functionality 



With regard to the previous releases, the present specification may define some new functions. Such new functions shall 
ensure full backwards compatibility with Pre-Rel-8 nodes conforming to 3GPP TS 29.060 [6]. If the new functions are 
specified with the Extension Headers, bits 8 and 7 of the Extension Header Type shall be set to 0, respectively or 0, 1 
respectively. If the new functions are specified with Information Elements, such Information Elements shall be TLV- 
encoded and optional. 



5 GTP-U header 

5.1 General format 

The GTP-U header is a variable length header whose minimum length is 8 bytes. There are three flags that are used to 
signal the presence of additional optional fields: the PN flag, the S flag and the E flag. The PN flag is used to signal the 
presence of N-PDU Numbers. The S flag is used to signal the presence of the GTP Sequence Number field. The E flag 
is used to signal the presence of the Extension Header field, used to enable future extensions of the GTP header defined 
in this document, without the need to use another version number. If and only if one or more of these three flags are set, 
the fields Sequence Number, N-PDU and Extension Header shall be present. The sender shall set all the bits of the 
unused fields to zero. The receiver shall not evaluate the unused fields. 
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Always present fields: 

Version field: This field is used to determine the version of the GTP-U protocol. The version number shall be set 
to '1'. 

Protocol Type (FT): This bit is used as a protocol discriminator between GTP (when PT is '1') and GTP' (when 
PT is '0'). GTP is described in this document and the GTP' protocol in 3GPP TS 32.295 [8]. Note that the 
interpretation of the header fields may be different in GTP' than in GTP. 

Extension Header flag (E): This flag indicates the presence of a meaningful value of the Next Extension Header 
field. When it is set to '0', the Next Extension Header field either is not present or, if present, shall not be 
interpreted. When it is set to '1', the Next Extension Header field is present, and shall be interpreted, as described 
below in this section. 

Sequence number flag (S): This flag indicates the presence of a meaningful value of the Sequence Number field. 
When it is set to '0', the Sequence Number field either is not present or, if present, shall not be interpreted. When 
it is set to '1', the Sequence Number field is present, and shall be interpreted, as described below in this section. 
For the Echo Request, Echo Response, Error Indication and Supported Extension Headers Notification 
messages, the S flag shall be set to '1'. Since the use of Sequence Numbers is optional for G-PDUs, the PGW, 
SGW, ePDG and eNodeB should set the flag to '0'. However, when a G-PDU (T-PDU+header) is being relayed 
by the Indirect Data Forwarding for Inter RAT HO procedure, then if the received G-PDU has the S flag set to 
'1', then the relaying entity shall set S flag to '1' and forward the G-PDU (T-PDU-nheader). In an End marker 
message the S flag shall be set to '0'. 

N-PDU Number flag (PN): This flag indicates the presence of a meaningful value of the N-PDU Number field. 
When it is set to '0', the N-PDU Number field either is not present, or, if present, shall not be interpreted. When it 
is set to '1', the N-PDU Number field is present, and shall be interpreted, as described below in this section. 

Message Type: This field indicates the type of GTP-U message. 

Length: This field indicates the length in octets of the payload, i.e. the rest of the packet following the mandatory 
part of the GTP header (that is the first 8 octets). The Sequence Number, the N-PDU Number or any Extension 
headers shall be considered to be part of the payload, i.e. included in the length count. 

Tunnel Endpoint Identifier (TEID): This field unambiguously identifies a tunnel endpoint in the receiving 
GTP-U protocol entity. The receiving end side of a GTP tunnel locally assigns the TEID value the transmitting 
side has to use. The TEID shall be used by the receiving entity to find the PDP context, except for the following 

cases: 

The Echo Request/Response and Supported Extension Headers notification messages, where the Tunnel 
Endpoint Identifier shall be set to all zeroes. 

The Error Indication message where the Tunnel Endpoint Identifier shall be set to all zeros. 

When setting up a GTP-U tunnel, the GTP-U entity shall not assign the value 'all zeros' to its own TEID. 
However, for backward compatibility, if a GTP-U entity receives (via respective control plane message) a peer's 
TEID that is set to the value 'all zeros', the GTP-U entity shall accept this value as valid and send the subsequent 
G-PDU with the TEID field in the header set to the value 'all zeros'. 



Optional fields: 

Sequence Number: If Sequence Number field is used for G-PDUs (T-PDUsH-headers), an increasing sequence 
number for T-PDUs is transmitted via GTP-U tunnels, when transmission order must be preserved. For 
Supported Extension Headers Notification and Error Indication messages, the Sequence Number shall be ignored 
by the receiver, even though the S flag is set to '1'. 

N-PDU Number: This field is used at the Inter SGSN Routeing Area Update procedure and some inter-system 
handover procedures (e.g. between 2G and 3G radio access networks). This field is used to co-ordinate the data 
transmission for acknowledged mode of communication between the MS and the SGSN. The exact meaning of 
this field depends upon the scenario. (For example, for GSM/GPRS to GSM/GPRS, the SNDCP N-PDU number 
is present in this field). 
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Next Extension Header Type: This field defines the type of Extension Header that follows this field in the 
GTP-PDU. 



NOTED 
NOTE 1 
NOTE 2 
NOTES 
NOTE 4 



Bits 
8 7 6 5 4 3 2 1 


Version PT (*) E S FN 


Message Type 


Length (1" Octet) 


Length (2™ Octet) 


Tunnel Endpoint Identifier (1*" Octet) 


Tunnel Endpoint Identifier (2™ Octet) 


Tunnel Endpoint Identifier (3™ Octet) 


Tunnel Endpoint Identifier (4'" Octet) 


Sequence Number (1" Octet)" "" 


Sequence Number (2™ Octet)" " 


N-PDU Number-^'"' 


Next Extension Header Type"'*' 



Octets 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 



(*) This bit is a spare bit. It shall be sent as '0'. The receiver shall not evaluate this bit. 

1 ) This field shall only be evaluated when indicated by the S flag set to 1 . 

2) This field shall only be evaluated when indicated by the PN flag set to 1 . 

3) This field shall only be evaluated when indicated by the E flag set to 1 . 

4) This field shall be present if and only if any one or more of the S, PN and E flags are set. 

Figure 5.1-1 : Outline of the GTP-U Header 



5.2 



GTP-U Extension Header 



5.2.1 General format of the GTP-U Extension Header 

The format of GTP-U Extension Headers is depicted in figure 5.2.1-1. The Extension Header Length field specifies the 
length of the particular Extension header in 4 octets units. The Next Extension Header Type field specifies the type of 
any Extension Header that may follow a particular Extension Header. If no such Header follows, then the value of the 
Next Extension Header Type shall be 0. 



Octets 1 
2- m 
m+1 



Extension Header Length 



Extension Header Content 



Next Extension Header Type 



Figure 5.2.1-1 : Outline of the Extension Header Format 

The length of the Extension header shall be defined in a variable length of 4 octets, i.e. m-nl = n*4 octets, where n is a 
positive integer. 

Bits 7 and 8 of the Next Extension Header Type define how the recipient shall handle unknown Extension Types. The 
recipient of an extension header of unknown type but marked as 'comprehension not required' for that recipient shall 
read the 'Next Extension Header Type' field (using the Extension Header Length field to identify its location in the 
GTP-PDU). 

The recipient of an extension header of unknown type but marked as 'comprehension required' for that recipient shall: 

If the message with the unknown extension header was a request, send a response message back with CAUSE set 
to "unknown mandatory extension header". 

Send a Supported Extension Headers Notification to the originator of the GTP PDU. 

Log an error. 
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Bits 7 and 8 of the Next Extension Header Type have the following meaning: 



Bits 
8 7 



IVIeaning 







Comprehension of this extension header is not required. An Intermediate Node shall forward it to 
any Receiver Endpoint 



Comprehension of this extension header is not required. An Intermediate Node shall discard the 
Extension Header Content and not forward it to any Receiver Endpoint. Other extension headers 
shall be treated independently of this extension header. 



Comprehension of this extension header is required by the Endpoint Receiver but not by an 
Intermediate Node. An Intermediate Node shall forward the whole field to the Endpoint Receiver. 
Comprehension of this header type is required by recipient (either Endpoint Receiver or Intermediate 
Node) 



Figure 5.2.1-2: Definition of bits 7 and 8 of the Extension Header Type 

An Endpoint Receiver is the ultimate receiver of the GTP-PDU (e.g. an RNC or the GGSN for the GTP-U plane). An 
Intermediate Node is a node that handles GTP but is not the ultimate endpoint (e.g. an SGSN for the GTP-U plane 
traffic between GGSN and RNC). 



Next Extension Header Field Value 


Type of Extension Header 


0000 0000 


No more extension headers 


0000 0001 


Reserved - Control Plane only. 


0000 0010 


Reserved - Control Plane only. 


0100 0000 


UDP Port. Provides the UDP 
Source Port of the triggering 
message. 


1100 0000 


PDCP PDU Number [4]-[5]. 


1100 0001 


Reserved - Control Plane only. 


1100 0010 


Reserved - Control Plane only. 



Figure 5.2.1-3: Definition of Extension Header Type 

5.2.2 Extension Header types 

Extension header types marked as "Reserved - Control Plane only" in figure 5.2. 1-3 are not used in the GTP user plane. 
These extension header types are defined in 3GPP TS 29.060 [6]. 

The following subclauses define the format of the extension header types applicable to the GTP user plane. 

5.2.2.1 UDP Port 

This extension header may be transmitted in Error Indication messages to provide the UDP Source Port of the G-PDU 
that triggered the Error Indication. It is 4 octets long, and therefore the Length field has value 1 . 



NOTE: 



8 


Bits 
7 6 5 4 3 2 


1 


0x01 


UDP Port number 


Next Extension Header Type (note) 



Octets 

1 

2-3 

4 



The value of this field is if no other Extension header follows. 

Figure 5.2.2.1-1 : UDP Port Extension Header 



5.2.2.2 



PDCP PDU Number 



This extension header is transmitted, for example in UTRAN, at SRNS relocation time, to provide the PDCP sequence 
number of not yet acknowledged N-PDUs. It is 4 octets long, and therefore the Length field has value 1 . 
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When used between two eNBs at the X2 interface in E-UTRAN, bits 5-8 of octet 2 are spare. The meaning of the spare 
bits shall be set to zero. 



NOTE: 



Bits 
5 4 



Octets 

1 
2 
3 
4 



The value of this field is if no other Extension header follows. 

Figure 5.2.2.2-1 : PDCP PDU Number Extension Header 



0x01 


PDCP PDU number 


PDCP PDU number. 


Next Extension Header Type (note) 



6.1 



GTP-U Message Formats 



General 



GTP-U defines a set of messages between the two ends of the user plane of the interfaces lu-U, Gn, Gp, Sl-U, S2b, S4, 
S5, S8, S12andX2-U. 

GTP-U messages are sent across a GTP user plane tunnel. A GTP-U message may be either a signalling message across 
the user plane tunnel, or a G-PDU message. 

GTP-U signalling messages are used for user plane path management, or for user plane tunnel management. 

G-PDU is a vanilla user plane message, which carries the original packet (T-PDU). In G-PDU message, GTP-U 
header is followed by a T-PDU. 

A T-PDU is an original packet, for example an IP datagram, from an UE, or from a network node in an external packet 
data network. 

The complete range of message types defined for GTPvl is defined in 3GPP TS 29.060 [6]. The table below includes 
those applicable to GTP user plane. The three columns to the right define which of the three protocols sharing the 
common header of GTPvl (GTP-C, GTP-U or GTP') might implement the specific message type. 

Table 6.1-1 : Messages in GTP-U 



Message Type 
value (Decimal) 


Message 


Reference 


GTP-C 


GTP-U 


GTP' 


1 


Echo Request 




X 


X 


X 


2 


Echo Response 




X 


X 


X 


3-25 


Reserved in 3GPP TS 32.295 [8] and 3GPP TS 
29.060 [6] 










26 


Error Indication 






X 




27-30 


Reserved in 3GPP TS 29.060 [6] 










31 


Supported Extension Headers Notification 




X 


X 




32-253 


Reserved in 3GPP TS 29.060 [6] 










254 


End IVIarker 






X 




255 


G-PDU 






X 





6.2 Presence requirements of Information Elements 

As specified in 3GPPTS 29.060 [6], subclause 7.1.1. 
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GTP-U Messages 



7.1 General 

GTP-U Tunnels are used to carry encapsulated T-PDUs and signalling messages between a given pair of GTP-U Tunnel 
Endpoints. The Tunnel Endpoint ID (TEID) which is present in the GTP header shall indicate which tunnel a particular 
T-PDU belongs to. In this manner, packets are multiplexed and de-multiplexed by GTP-U between a given pair of 
Tunnel Endpoints. The TEID value to be used in the TEID field shall be negotiated for instance during the GTP-C 
Create PDP Context and the RAB assignment procedures that take place on the control plane. 

For MBMS IP Multicast Distribution, the TEID value to be used in the TEID field shall be allocated at the source 
Tunnel Endpoint and signalled to the destination Tunnel Endpoint using for instance the GTP-C MBMS Session Start 
procedures that take place on the control plane. Because of the point-to-multipoint characteristics of MBMS IP 
Multicast Distribution, the path management messages Echo Request and Echo Response, the tunnel management 
message Error Indication, the message Supported Extension Headers Notification and the message End Marker shall not 
be used for MBMS IP Multicast Distribution. 

User payload is transmitted in G-PDU packets. A G-PDU is a packet including a GTP-U header and a T-PDU. A G- 
PDU may include extension headers. A G-PDU shall not include any information element. 

GTP-U signalling messages are classified into path management messages, defined in subclause 7.2 of the present 
document, and tunnel management messages, defined in subclause 7.3 of the present document. 

7.2 Path Management Messages 
7.2.1 Echo Request 

A GTP-U peer may send an Echo Request on a path to the other GTP-U peer to find out if it is alive (see section Path 
Failure). Echo Request messages may be sent for each path in use. A path is considered to be in use if at least one PDP 
context, EPS Bearer, MBMS UE context, or MBMS bearer context uses the path to the other GTP-U peer. When and 
how often an Echo Request message may be sent is implementation specific but an Echo Request shall not be sent more 
often than every 60 s on each path. This doesn"t prevent resending an Echo Request with the same sequence number 
according to the T3-RESPONSE timer. 

Even if there is no path in use, a GTP-U peer shall be prepared to receive an Echo Request at any time and it shall reply 
with an Echo Response. The optional Private Extension contains vendor or operator specific information. 

Table 7.2.1-1 : Information Elements in an Echo Request 



Information element 


Presence requirement 


Reference 


Private Extension 


Optional 


8.6 



For the GTP-U tunnel setup between two nodes for forwarding user traffic, e.g. between eNodeBs for direct forwarding 
over X2, Echo Request path maintenance message shall not be sent except if the forwarded data and the normal data are 
sent over the same path. 

7.2.2 Echo Response 

The message shall be sent as a response to a received Echo Request. 

The Restart Counter value in the Recovery information element shall not be used, i.e. it shall be set to zero by the 
sender and shall be ignored by the receiver. The Recovery information element is mandatory due to backwards 
compatibility reasons. 

The optional Private Extension contains vendor or operator specific information. 
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Table 7.2.2-1 : Information Elements in an Echo Response 



Information element 


Presence requirement 


Reference 


Recovery 


IVIandatory 


8.2 


Private Extension 


Optional 


8.6 



7.2.3 Supported Extension Headers Notification 

This message indicates a list of supported Extension Headers that the GTP entity on the identified IP address can 
support. This message is sent only in case a GTP entity was required to interpret a mandatory Extension Header but the 
GTP entity was not yet upgraded to support that extension header. The GTP endpoint sending this message is marked as 
not enabled to support some extension headers (as derived from the supported extension header list). The peer GTP 
entity may retry to use all the extension headers with that node, in an attempt to verify it has been upgraded. 
Implementers should avoid repeated attempts to use unknown extension headers with an endpoint that has signalled its 
inability to interpret them. 

Table 7.2.3-1 : Information Elements in Supported Extension Headers Notification 



Information element 


Presence requirement 


Reference 


Extension Header Type List 


Mandatory 


8.5 



7.3 Tunnel Management Messages 



7.3.1 



Error Indication 



When a GTP-U node receives a GTP-U PDU for which no EPS Bearer context, PDP context, MBMS Bearer context, or 
RAB exists, the GTP-U node shall discard the GTP-U PDU and return a GTP error indication to the originating node. 
GTP entities may include the "UDP Port" extension header (Type 0x40), in order to simplify the implementation of 
mechanisms that can mitigate the risk of Denial-of-Service attacks in some scenarios. 

Handling of the received Error Indication is specified in 3GPP TS 23.007 [3]. 

For the GTPvl-U tunnel setup between two nodes for direct or indirect forwarding of user traffic, e.g. between 
eNodeBs for direct forwarding over X2, when an Error Indication is received, it may result in the source node deleting 
the forwarding tunnel context locally, but EPS bearers shall not be deactivated. 

The information element Tunnel Endpoint Identifier Data I shall be the TEID fetched from the G-PDU that triggered 
this procedure. 

The information element GTP-U Peer Address shall be the destination address (e.g. destination IP address, MBMS 
Bearer Context) fetched from the original user data message that triggered this procedure. A GTP-U Peer Address can 
be a GGSN, SGSN, RNC, PGW, SGW, ePDG or eNodeB address. The TEID and GTP-U peer Address together 
uniquely identify the related PDP context, RAB or EPS bearer in the receiving node. 

The optional Private Extension contains vendor or operator specific information. 

Table 7.3.1-1 : Information Elements in an Error Indication 



Information element 


Presence requirement 


Reference 


Tunnel Endpoint Identifier Data 1 


IVIandatory 


8.3 


GTP-U Peer Address 


Mandatory 


8.4 


Private Extension 


Optional 


8.6 



7.3.2 End Marker 

End Marker message shall be as specified in 3GPP TS 23.401 [5]. The End Marker message shall be sent for each GTP- 
U tunnel (multiple messages). Each GTP-U tunnel is identified with a respective TEID value in the GTP-U header. The 
End Marker message indicates the end of the payload stream on a given tunnel, i.e. a G-PDU that arrives after an End 
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Marker message on this tunnel may be silently discarded. Table 7.3.2-1 specifies the information element included in 
the End Marker message. 

If an End Marker message is received with a TEID for which there is no context, then the receiver shall ignore this 

message. 

The optional Private Extension contains vendor or operator specific information. 

Table 7.3.2-1 : Information Elements in End Marker message 



Information element 


Presence requirement 


Reference 


Private Extension 


Optional 


8.6 



8 



Information Elements 



8.1 Information Element Types 



A GTP-U Signalling message may contain several information elements. The TLV (Type, Length, Value) or TV (Type, 
Value) encoding format shall be used for the GTP information elements. The information elements shall be sorted, with 
the Type fields in ascending order, in the signalling messages. The Length field contains the length of the information 
element excluding the Type and Length field. 

For all the length fields, bit 8 of the lowest numbered octet is the most significant bit and bit 1 of the highest numbered 
octet is the least significant bit. 

Within information elements, certain fields may be described as spare. These bits shall be transmitted with the value 
defined for them. To allow for future features, the receiver shall not evaluate these bits. 

The most significant bit in the Type field is set to when the TV format is used and set to 1 for the TLV format. 



Octets 

1 

Octets 

1 


8 


7 


Bits 

6 5 4 3 


2 


1 







Type -> TV format 




8 


7 


Bits 

6 5 4 3 


2 


1 




1 


Type -> TLV format 

















Figure 8.1-1 : Type field for TV and TLV format 

The complete range of information element types defined for GTPvl is defined in 3GPP TS 29.060 [6]. The table below 
includes those applicable to GTP user plane. 

Table 8.1-1 : Information Elements 



IE Type 
Value 


Format 


Information Element 


Reference 


0-13 


TV 


Reserved in 3GPP TS 29.060 [6] 




14 


TV 


Recovery 


8.2 


15 


TV 


Reserved in 3GPP TS 29.060 [6] 




16 


TV 


Tunnel Endpoint Identifier Data 1 


8.3 


17-132 


TV/TLV 


Reserved in 3GPP TS 29.060 [6] 




133 


TLV 


GSN Address 


8.4 


134-140 


TLV 


Reserved in 3GPP TS 29.060 [6] 




141 


TLV 


Extension Header Type List 


8.5 
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IE Type 
Value 


Format 


Information Element 


Reference 


0-13 


TV 


Reserved in 3GPP TS 29.060 [6] 




142-254 


TLV 


Reserved in 3GPP TS 29.060 [6] 




255 


TLV 


Private Extension 


8.6 



8.2 Recovery 



The value of the restart counter shall be set to by the sending entity and ignored by the receiving entity. This 
information element is used in GTP user plane due to backwards compatibility reasons. 



Octets 


Bits 

8 7 6 5 4 3 2 1 


1 
2 


Type = 14 (Decimal) 


Restart counter 







Figure 8.2-1 : Restart Counter Information Element 



8.3 Tunnel Endpoint Identifier Data I 

The Tunnel Endpoint Identifier Data I information element contains the Tunnel Endpoint Identifier used by a GTP 
entity for the user plane. 



Octets 

1 

2-5 


8 


Bits 
7 6 5 4 3 2 


1 




Type = 16 (Decimal) 




Tunnel Endpoint Identifier Data 1 











8.4 



Figure 8.3-1 : Tunnel Endpoint Identifier Data I Information Element 



GTP-U Peer Address 



The GTP-U peer Address information element contains the address of a GTP. The Length field may have only two 
values (4 or 16) that determine if the Value field contains IPv4 or IPv6 address. 

The IPv4 address structure is defined in RFC 791 [10]. 

The IPv6 address structure is defined in RFC 2373 [11]. 

The encoded address might belong not only to a GSN, but also to an RNC, eNodeB, SGW, ePDG or PGW. 
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Octets 


Bits 

8 7 6 5 4 3 2 1 


1 
2-3 
4-n 


Type= 133 (Decimal) 


Length 


IPv4 or IPv6 Address 







Figure 8.4-1 : GTP-U Peer Address Information Element 



8.5 Extension Header Type List 



This information element contains a list of 'n' Extension Header Types. The length field is set to the number of 
extension header types included. 



Octets 
1 
2 
3-n+2 



Bits 
6 5 4 3 2 



Type = 141 (Decimal) 



Length (value= n) 



Extension types list 



Figure 8.5-1 : Extension Header Type List Information Element 



8.6 Private Extension 

The Private Extension information element contains vendor specific information. The Extension Identifier is a value 
defined in the Private Enterprise number list in the most recent "Assigned Numbers" RFC (RFC 1700 or later). 

This is an optional information element that may be included in any GTP Signalling message. A signalling message 
may include more than one information element of the Private Extension type. 



Octets 

1 

2-3 

4-5 

6-m 


Bits 
8 7 6 5 4 3 2 


I 1 




Type = 255 (Decimal) 




Length 


Extension Identifier 


Extension Value 









Figure 8.6-1 : Private Extension Information Element 



Error Handling 



9.1 Protocol Errors 

As specified in 3GPP TS 29.060 [6], subclauses 11.1. 
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9.2 Path Failure 

A path counter shall be reset each time an Echo Response is received on the path and incremented when the T3- 
RESPONSE timer expires for any Echo Request message sent on the path. The path shall be considered to be down if 
the counter exceeds N3-REQUESTS. In this case, the GTP-U peer may notify the Operation and Maintenance network 
element. The GTP-U peer shall also notify the upper layer of the path failure, so that PDP or EPS contexts associated 
with the path may be deleted. 



10 Security 

Network domain security is specified in 3GPP TS 33.102 [21] and 3GPP TS 33.401 [22]. 

1 1 Reliable Delivery of Signalling Messages 

Each path maintains a queue with signalling messages to be sent to the peer. The message at the front of the queue, if it 
is a request for which a response has been defined, shall be sent with a Sequence Number, and shall be held in a path 
list until a response is received. Each path has its own list. The Sequence Number shall be unique for each outstanding 
request message sourced from the same IP/UDP endpoint. 

The T3-RESPONSE timer shall be started when a signalling request message (for which a response has been defined) is 
sent. A signalling message request or response has probably been lost if a response has not been received before the T3- 
RESPONSE timer expires. At the expiry of the timer the request is retransmitted if the total number of request attempts 
is less than N3-REQUESTS times. 

All received request messages shall be responded to and all response messages associated with a certain request shall 
always include the same information. Duplicated response messages shall be discarded. A response message without a 
matching outstanding request should be considered as a duplicate. 

If a GTP protocol entity is not successful with the transfer of a signalling message, it shall inform the upper layer of the 
unsuccessful transfer so that the controlling upper entity may take the necessary measures. 

12 GTP Parameters 

12.1 General 

The GTP system parameters defined here and their recommended values shall not be fixed, but shall be possible to 
configure as described in section 'Reliable delivery of messages'. 

12.2 Timers 

The timer T3-RESPONSE holds the maximum wait time for a response of a request message. 

12.3 Others 

The counter N3-REQUESTS holds the maximum number of attempts made by GTP to send a request message. The 
recommended value is 5. 
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13 Tunnelling Scenarios 

13.1 General 

There are user packets sent between network nodes without a GTP-U reference point defined. The scenarios and 
apphcability of GTP-U tunnelling are described in the following sections. 

13.2 Tunnelling between Serving GWs 

GTP T-PDU tunnelling is applicable from the old Serving GW to the new Serving GW only when indirect forwarding is 
applicable during a SI -based Handover procedure or inter-RAT handover procedure with SGW Relocation, as 
described in the 3GPP TS 23.401 [5]. For the GTP-U tunnel setup between Serving GWs, path maintenance messages 
do not need to be sent. 

13.3 Transfer of the user plane data between PDN GWs 

GTP shall not specify tunnelling between PDN GWs. Transfer of UE-to-UE traffic between PDN GWs shall use the 
SGi interface. 

13.4 Tunnelling between SGSNs 

T-PDUs, stored in the old SGSN and not yet sent to the MS, shall be tunnelled to the new SGSN as a part of the Inter 
SGSN Routeing Update procedure described in 3GPP TS 23.060 [4]. Some T-PDUs may still be on their way from the 
GGSN to the old SGSN because they have been sent before the tunnel change. These T-PDUs shall also be tunnelled to 
the new SGSN. 

For intersystem SRNS Relocation, the establishment of the GTP tunnel(s) for the forwarding of G-PDUs is as described 
in the 3GPP TS 23.121 [13] and in the 3GPP TS 23.060 [4] specifications. 

For PS Handover, the establishment of the GTP tunnel(s) for the forwarding of G-PDUs is as described in the 3GPP TS 

43.129 [14]. 

13.5 Tunnelling between Source RNC and Target RNC 

For the 3G-3G SRNS Relocation, the establishment of the GTP tunnel for the forwarding of G-PDUs between source 
and target RNC, is as described in the 3GPP TS 23.121 [13] and in the 3GPP TS 23.060 [4] specifications. 

1 3.6 Transfer of the user plane data between GGSNs 

GTP shall not specify tunnelUng between GGSNs. Transfer of MS-to-MS traffic between GGSNs shall use the Gi 
interface. 
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